EMS Manual

Burst Detection and Suppression
EMS Manual—426909-005
7-4
BDS Parameters

Possess the same value for their first subject
Collectors convert text generated by a sender-invoked WRITE procedure into text
events. Two or more text events are considered similar only if their text is identical.
The BDS parameters in Table 7-1 represent both the directives used to construct a
burst filter and the parameter values specified with the SUPPRESS keyword of the
EMSACOLL and EMSCCTRL programs. Once you supply these directives, either
through a burst filter or an EMSACOLL or EMSCCTRL SUPPRESS command, BDS is
enabled, and EMS can monitor the event stream, detecting event bursts on the basis
of the N, T1, and L parameter values.
When an event burst is detected, EMS suppresses logging of the bursting event until it
determines that the burst has ended. If no value is specified for a given parameter, its
default value is automatically applied.
When an event burst is detected, the EMS collector or distributor generates a burst-
detected event that describes the bursting event. This description identifies the
subsystem that generated the event burst, the event number, and the token code of
Note. You can consider events similar if they have the same SSID and event number, without
regard for their subject tokens and values. BDS allows an option for omitting the subject token
code and subject value from the comparison criteria.
Table 7-1. Burst Detection Parameter Meanings and Default Values
Parameter Meaning Default Value
N The number of events that constitute a burst 100 events
T1 The time period in which N events constitute a burst 100 seconds
T2 The time period during which the occurrence of no events
ends a burst
120 seconds
T3 The time interval between checks for ended bursts 300 seconds
L The comparison byte length of the first subject value 254 bytes
S The maximum number of simultaneous bursts that can be
detected and monitored
6 bursts
Table 7-2. Value Ranges for Burst Detection Parameters
Parameter Minimum Value Maximum Value
N 2 events 32,767 events
T1 1 second 3600 seconds (1 hour)
T2 1 second 3600 seconds (1 hour)
T3 15 seconds 3600 seconds (1 hour)
L 0 bytes
*
254 bytes
S 2 bursts 128 bursts
*
L can also be set to -1, which means that the subject token code is ignored in determining event similarity.